EP151 Cyber Insurance in the Cloud Era: Balancing Protection, Data and Risks

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the Senior PM for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button in your podcasting app of choice. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on LinkedIn. Anton, this one actually first showed on LinkedIn as a livestream. We had fun audience questions which got injected, and it is about the way more exciting than people would give it credit for. topic of insurance.

Actually, it's insurance and cloud.

And cyber.

And I feel like it's cyber insurance and cloud. It's not like fire insurance and cloud. I think the risk of that is kind of low.

But we talked about that at one point.

We did, in fact, yes. But I feel like this episode made cyber insurance maybe not fun as such, but definitely accessible and a lot more understood and a lot more myth-prone. than it has been. And I think that's huge value in the guest's ability to explain that in very human terms.

Well, it speaks to her true expertise in the area. I had been looking forward to having Monica on the show for, well, years, honestly. And so maybe without further ado, let's turn things over to today's guest. Listeners, welcome to an extra special live episode of the Cloud Security Podcast by Google. Thank you for joining us today. I'm delighted to introduce today's guest. Today we are joined by Monica Chokrai, the Head of Business Risk and Insurance here at Google Cloud. Monica, I've been looking forward to having you on the show for ages at this point. So thank you for joining us. I'm glad our schedules lined up.

Thanks for having me.

Of course, we're delighted. I joked that insurance is a really boring topic, and I hope we can prove that I was wrong today. And we've stayed away from this on the show because it's really hard to find people who actually understand it or know what's going on. And I think of all the areas of security, maybe with the exception of AI, This has the most FUD, fear, uncertainty, and doubt, of any area I've ever seen. So could you maybe give us just a 30-second rundown of what cyber insurance is and is not?

Yeah, absolutely. So cyber insurance at a high level covers a business for a financial loss that results from a cyber event. So cyber event could be a data breach or an outage of some sort, and very high level, that's how I would think about it. Those losses can be broken down in a variety of ways. So you can think about it as the cost of investigating a loss, responding to a cyberattack, repairing damaged computer systems, notifying customers of a data breach, anything from when it first starts to basically remediating it. And what's special about cyber insurance is that a lot of insurance policies either cover first-party loss, like what's happening to make you whole, or third-party loss, what liability do you have to another party, and cyber insurance covers both. So, in the event that you're liable to another party for a data breach, it would cover those legal fees and the costs to that other party.

Well, now, that's pretty interesting.

Can I have an amateurish question?

Yeah.

Amateurish question, amateur hour, amateur minute.

Yes.

So, I've met, during my Gartner days, I've met people who, after a breach, would call cyber insurance and say, I had a breach. Can you please pay for me creating a security program, which I failed to create before today? I take it the answer would usually be no. Tim is snorting.

Yeah, that's right. Generally, they'll help put you in a better place. So for example, if there's computer systems that have bricking coverage, if there's computer systems that are no longer usable, they can replace those with something that's better than you had before. But implementing a new security program from scratch is not something that I would see as being covered. You think about cyber insurance as trying to make you whole. So ideally, it's getting to the place that you were before the attack.

Is that like saying, I crashed my car, my VW is ruined, please get me a Ferrari? That seems a little silly.

Yes, exactly. That's what Anton wants and probably not what you're going to get.

That's right. But I think that I actually don't want that. I never had a car. My garage burned down. And I want you now to fix my garage and also put a car in there. That's a more apt analogy.

Yeah.

That's fair.

Yeah, it's actually worse than your case. But okay, so let's go to something more realistic, and that would be cloud. This is a cloud security podcast. So, how does cloud change that? Because I take it we are not covering any of the old-school cyber risks like bricked laptops or whatnot. And ultimately, there is shared responsibility because there's a cloud service provider involved. So, how does cloud change cyber insurance? If you can answer in shorter than, say, 40, 50 minutes, minutes, it will be really appreciated.

So insurance policies are actually infrastructure agnostic, and that's a really good thing for customers. So when you think about a loss that were to occur, whether it's a data breach or an outage, it doesn't actually matter whether it happens on-prem or within the cloud environment. The insurance policy is responding to what happened. I think a while ago, it's probably been a year or so, a lot of different carriers started coming up with cloud-only policies. cyber insurance policies, or there's some companies that are doing an outage-only policy. And that's created a lot of confusion in the market because now buyers are wondering, like, well, is that all I need? Or do I need the whole policy? Or how do I mix and match them? So I think that there's some confusion around that. But generally speaking, what I'd recommend is to get a holistic cyber insurance policy because you really don't know where the loss is going to originate from. What I think you're getting at, though, is that the risk is different from an on-prem environment and a cloud environment. And I do think that insurers recognize that and are starting to price for it in terms of how they look at their policies. Happy to expand on that more.

What does that mean, price for that?

Well, price for that, it's not just about the price, right? I was just like, I hope Tim wouldn't pounce on the price, but he did.

Well, I want Monica to speak normal security person language, not insurance person language. What does it even mean to price for that? Does that mean they give you a better price, a worse price? What does that mean?

So a little of both. So if you look at cloud risk or just cyber insurance risk in general, right, split it into 2 categories, security risk and then reliability, resiliency, outage-type risk. And I think insurers look at them very differently. If you look at security risk, and we focus on that first, I think it's commonly accepted within the cyber insurance space that cloud can be more secure than an on-prem environment. If you take Phil Venable's Megatrends, I know you had him on the podcast before, from a very high level— Super.

7 times. We just want to say this aloud 7 times. This is important. Everybody, we got Phil DeAnubis on the podcast 7 times.

It's a great get. That's awesome. So, the megatrends indicate that the gap is even widening over time between on-prem and cloud. And I think insurers understand that. They've bought into that at a high level. And when I say price for that, to answer Tim's question, when they're thinking about the risk, they'll give you credit. for being on the cloud. One example that came out recently is Atbay and Coalition, 2 different cyber insurance companies, published studies that showed the difference between, in this case, Workspace and other email providers. But there's also a difference within there on cloud email providers and not. And there's a drastic difference. One of them is indicating 40% less premium. The other one is saying if you have an on-premise email solution, it's 3 times more likely that you'll file a claim. So there's a lot of focus in there. that space.

Wait, wait, wait, hang on. If you have an on-prem email that you're hosting yourself, you're 3 times more likely to file the claim.

That's very reasonable. That's reasonable.

Yeah. And they also compared Workspace's cloud-based, right? They compared Workspace to other email providers and said that your premium will go down 40 to 50%, depending on how you look at it. 40% is what you'll see in the headlines. If you double-click on the data, it's up to 50%.

Wow. Wow.

So yeah.

So the actuarial people have spoken and there's something to this whole SaaS business.

Yes.

Wow.

Absolutely. And to date, you'll see that story being told about Workspace in particular. I think over time you'll see that trend to continue. More technology providers, maybe even cloud providers, that might— them differentiating between the security of them. The second part of your question is a lot harder and difficult because insurers are worried about accumulation risk. So aggregation risk, every policyholder is hit at once and suddenly I I, as an insurance company, might go under because I just can't support the losses.

So the real-world analogy would be if everybody moved to Tampa and Miami, you would have 2 centers of weakness and they could both get hit with a hurricane. Or even if one gets hit, since half the people are living there, you're in deep doo-doo.

Exactly, exactly. Because the game of insurance is diversification. That's how you win in insurance. And if there's a highly correlated event that could happen and affect multiple houses in Florida, like a hurricane, you're in a difficult place. And so from that perspective, the insurance market is really trying to understand cloud providers and the aggregation risk associated with them. And I think that there is a big gap in terms of how cyber modeling firms and insurers understand it and how cloud service providers understand it. And I think we could probably work with them to improve that over time.

I like listeners. I just want to note, I use the phrase deep doo-doo. Monica much more adroitly said a difficult Difficult place. I think those mean the same thing though. And so I want to keep picking on this thread of assessing cloud risk, not the risk of cloud as a concentration of people, but, you know, it's hard for us on the show to find CISOs, with the exception of Jeremiah last week, who was just amazing, who get cloud, right? Are there insurers and underwriters?

It's a little too dark. I think it's a little dark. We had CISOs who are huge cloud enthusiasts.

Okay, fine. But it's hard to find them in general. You know, we've gotten all of them, I think, at this point.

Yes. No.

How do you find insurers who get cloud? We had Tim Dirks on the show talk about, like, building codes for cloud. Is there an equivalent for cloud? Like, how do people assess this?

I think at a high level, they're at a good place. At a high level, they understand differences in risk and how to potentially account for that. At a detailed level, I think there's a long way to go. And that's not because they're not trying. It's not because they don't have their own security experts. It's just because their relationship is not with the cloud service provider at the end of the day, right? relationships are with their insureds. And so there are a number of situations that I'll actually get pulled into where a customer's trying to explain something to their insurer that has to do with cloud, and then our team will help support that explanation at times and be that middle ground. And as I think you both know, we have a program, the Risk Protection Program, that actually focuses on how can we help insurers better understand cloud and better utilize the metrics that our own customers are using to secure their own environment.

So, wait. So, that means that also insurance in this case is almost like a force to improve cloud security even further, because the more data shows up, the more people would be pushed to certain practices that actually work. I mean, it's— people in our industry have been known to kind of joke about the term best practice, because in some cases, it's just like a vague position somebody had, very purely opinion-based. But in this case, it sounds like the more we work on this, the more we have the datasets for actually what works best? So, for example, we heard of a case when an insurer reduces coverage for incidents caused by old CVEs. Like, is this the magic answer to improving security? That's really what I want to ask. Sorry, I should have said just that.

Yeah, so I wish it was the magic answer, and I think it has the potential to be the magic answer. But looking at a high level, insurance, when you think of property insurance as an example, has the potential to incentivize the right behavior.

You don't get property insurance unless you have your I'm sorry for being a bit of an interrupting person, but potential, it sounds like a strong force to improve things, to make them better.

Yes.

Why is it softer than, here's a strong force to improve security? Why fudge? It seems very direct.

Because it just hasn't happened yet.

Oh, okay.

It hasn't happened yet. And the reason it hasn't— well, one of the reasons it hasn't happened yet is they're not getting the data at a very detailed level from the inside out in the way that they would need to force that feedback loop. Another reason is that the way of assessing risk is very structured in a PDF that they've had for quite some time, and all their models follow those questions. And cyber risk is changing constantly. And so, there's not a dynamic feedback loop that's been created. I do think there's many organizations that see the potential, but it hasn't happened yet. And I think it'll take some time to close that gap.

I think the dynamic point is really interesting, right? It's not like you can accidentally remove the sprinkler system from a building, but it's pretty It's so easy in cloud to accidentally remove a key protection when you update that Terraform config or click a button in console. That's fascinating to me.

Absolutely. There's an industry emerging called InsureSec, which is essentially coupling security tools.

Wait, wait, how do you spell that? I want to add a link to the notes.

InsureSec.

Ah, okay.

I think AppBay coined the term, or at least in terms of my awareness, but coupling the two, because if you don't have tools that are measuring things on a live basis and at a detailed level, you're really going to miss a lot of the insurance risk. But by coupling them, you create the same shared incentives across the groups.

That's really cool that they're automating that.

Yeah.

So I want to pick at a different aspect of cyber insurance, one that I've heard about from people. And this might be a bit of a, bit of a meme, a bit of a trope, but I hear a lot of concern from people about, well, is cyber insurance even going to pay out? Are they going to say, oh no, that was cyber war, we don't cover cyber war, we don't cover acts of God. Your data center burned down as an act of God, or it was the Russians. So, is that a thing? Is that just FUD? Is that— what's going on with that part of the world?

So, there's many layers to it. So, insurance 100% has a reputational problem. And if you think about just insurance as an industry, right? And if you think about why, it's a financial product, which typically is straightforward, but underlying it is a legal contract. And that legal contract has a lot of exclusions, a lot of details, and you don't necessarily know upfront what it's going to cover when you're buying a policy, unless you have someone that, A, explains it to you, or there's a lot of case law. And cyber insurance is even more difficult because there's not a lot of case law in that space.

Hmm.

And the type of attacks that happen, they vary. And so you don't necessarily know how something will evolve specifically with regards to cyber war as an example. So I think the concern is warranted, but when you actually look at cyber insurance in particular, it's very broad. And the coverage issues that have come out in the media were actually not on a cyber insurance policy. It was on a property policy that happened to also have a war exclusion that excluded cyber.

Oh.

And so I think there's a lot of confusion out there. Happy to double-click on the exclusions, though.

But exclusions are one thing, and then there's a fact base behind them. But what about the fears that insurance won't pay because your security is so abysmally bad that it is not just like— it should not have worked? I mean, I'm being a little maybe unclear, but my example with somebody who never had a program, I think you probably would say that insurance would catch that at the signup stage, right?

Yes. So, that's a common concern specifically with CISOs, that they're going to say something on their application that's maybe 95% true, Yes. From my perspective, that rarely is an actual concern. And the reason that I say that is that the responsibility to prove that the insured was wrong is on the insurer, and there's a lot of legal costs and fighting associated with that. And generally speaking, it's not a battle that they're going to try to fight, or at least that I have not seen in that space. If you are extremely fraudulent on your application, that's another thing. But when it's a gray area, like, do you have MFA, yes or no? You put yes, and it's enabled in 99% of your environment. I think those sorts of things I personally don't think are a real concern. Of course, you have to be— you have a legal obligation to say the right thing on your application, but they assume good intent.

OK. There's an audience question, and it's connected to audits. So the question is really, does the insurance process feed back into quarterly audits? And to me, this is interesting because if insurance leads to some security improvements, would those improvements be fed into the audits? I have no idea what about the truth, but I guess Monica does.

Yeah. So, there's overlaps with audits, but just one clarification, Anton. You're saying if you improve your cyber insurance, if you improve your security footprint because of insurance, do you feed that back into audits?

You know what? That's how I was reading the question.

That's how I would read it.

Okay.

Yeah. Okay. But does the insurance process feed back into quarterly audits?

I would say no, not right now, but I'll talk a little bit about that. So, cyber insurance is generally underwritten on an annual basis. When you're going through that process, you procure cyber insurance, and oftentimes you don't hear from them for quite some time until the next time that you're getting insurance. So, I don't see insurance feeding audit, but I do see a trend where the different audits and compliance reports that you need to do might be feeding insurance over time because there is a lot of overlap between the way the two industries think about security risk, and trying to merge that and reduce the questionnaires on CISOs and security teams would be highly favored by many security professionals.

I like that. I like that a lot. I think one other interesting area that we could spend some time picking at is the relationship that Google has with our customers and with insurers and the risk program. What does that interesting middle ground look like, and how do we balance the differing incentives of the different parts of Google when we're doing that?

Yeah, absolutely. So what we have mostly for the audience is a program called the Risk Protection Program. And what we do through that program is that we essentially allow our customers to scan their cloud environment for metrics indicative of risk. And then through a couple clicks, they can share that with insurance companies. And when you think about getting insurance companies to start to use inside-out data and start to use metrics from within your cloud environment, a cloud provider needs to get involved in that space to help facilitate that transfer of information. One of the things that we do with that program as well is sit down with insurers so that they can understand the details of the metrics and how to incorporate that within their actuarial models. I personally think that that's the future, that's the path forward, so that we're active stakeholders in helping our customers with their security and helping insurers help them with their security and enforce— feeding that feedback loop.

So, you mentioned actuarial data. And before this current excitement about cyber insurance, maybe 5, 7 more years ago, I think a lot of people had the fears that actuarial data is not coming, or it's not reliable, or people would point out that car crashes data going back, you know, 100 years, and cyber being kind of recent, and data collection being imperfect. Is there even sense in asking how soon do you think we'll have good actuarial data about risks in the cloud specifically? And then now, I'll ask a sub-question right away. What about the concern that the cyber risks change? And admittedly, when I was thinking this question up, I wanted to say naively, unlike other risks, like, say, weather, and then I'm like, that's a bad example. Weather risks do change. So, when would we have the data? And how would we deal with the fact that the cyber risks change?

Anton, did you just make a super depressing global warming reference? I think you did.

I think I made a super depressing global warming reference, and I kind of made it sound like a joke, but it actually wasn't a joke. It was kind of more sad.

It's really appropriate though, because it's like 80 degrees in San Francisco today, and it's not right for it to be this way. Gosh, that's depresso. Monica, can you answer a happier question and take us off of global warming?

Yes. I do think, again, talking about cloud at a high level, more broadly, I think actual data is getting Mm-hmm. It's what products do you use? Are you on cloud or not, et cetera? When we're talking about control-level data, which to me is what I get most excited about, when can we get to a place where insurers can say, if you implement X control, your risk goes down by Y percent? That would be very helpful for the toil that a lot of security practitioners go through. I think that takes a couple steps. Step number one is that you have enough market share within your portfolio that you're actually collecting that data.

Mm.

And that requires a lot of data collection. A lot of industry players to help allow insurers to get that data to collect it, right? So that's step number one, and we're definitely not there as a whole. Google's doing it, but as a whole, we're not there. And then after that, I think it'll take a few years to get to the place where the claims trickle in and you can start to do that correlation. So we're on that path for sure. There's actually a lot of different firms that aren't even cyber insurance firms that are working on that problem, but I think it will take The second part of the question with regards to weather, can you remind me of it?

The point was about change.

Oh, yes.

There's no point collecting actuarial data. Is your stateless firewall effective? And even if you start in 1992 and collect data to 2012, the data today may not be all that useful. So, tech changes, risks change. How can you do actuarial data if everything changes? This is the cyberland, after all.

Yeah, absolutely. I think that is where the industry of InsurTech comes in, because as you start to couple the two and have live data feeds, that's the only way that you'll get enough data to help the customer from an actuarial perspective. So, if you think of auto insurance as an example, they have usage-based insurance using telematics in your car, and that fuels a risk score. Think about Tesla and the risk scoring that they have. It's connected with their insurance, and it's all one product. And so I think over time, as the security base gets to that point, live data will be a little bit more normal in the insurance space. But I wouldn't say that it's normal today. A lot of insurtechs are doing it for SMBs, but across the board, it's not widely adopted.

Well, Monica, I have the feeling that we could talk about this all day, but unfortunately we can't. I have to ask our traditional closing questions. One, do you have a tip to help people better cyber insure themselves? Do you have recommended reading for our audience?

Yes. In terms of a tip, it's read your insurance policy or bother your broker to help you understand. It's a tip and reading. That's true. It is. But yeah, maybe the tip is bother your broker because they do this all day, every day. They know the nuances and they're seeing the trends in claims so they can help you prevent an issue of thinking you're covered when you're actually not. In terms of reading, I thought about this. It's really boring readings, but I'll give you 2. One, One is Bard, our AI tool that Google has, actually is great at insurance questions. So I ask it insurance coverage questions often just to help me draft an answer. And I think that it's been pretty accurate. So that's one. And then 2 is there's a book called Cyber Insurance Policy by Josephine Wolf, who's a researcher. I think she's at Tufts. She's an academic, and it helps to break down a lot of the history of cyber insurance. So when you're trying to understand why something is the way it is, it's a good Well, Monica, thank you so much for joining us today.

I really can't thank you enough because I think insurance is such a hairy, complicated thing, and this really, perhaps to my own detriment, made me feel like I understand it better. So with that cheery thought, thank you for joining us.

Yeah, thank you so much. I've been— I've told you this before, but fan from day one. I love this podcast, so thanks for having me, and awesome work on what you both have developed.

Thank you.

Perfect. Thank you very much.

Thank you.

And now we are at time. Thank you very much for listening, and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.